[PATCH 04/13] New remediation

Shawn Wells shawn.d.wells at gmail.com
Sat Sep 7 19:22:58 UTC 2013


-------------- next part --------------
>From e293c7b812c42f43d294c1efbfbbdea4e9de88e9 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 7 Sep 2013 11:29:11 -0400
Subject: [PATCH 04/13] New remediation: sshd_use_approved_ciphers

testing:
Testing on /etc/ssh/sshd_config with no Ciphers value set:
[root at rhel6 bash]# grep Ciphers /etc/ssh/sshd_config ; bash sshd_use_approved_ciphers.sh ; grep Ciphers /etc/ssh/sshd_config
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

Testing with incorrect Ciphers value:
[root at rhel6 bash]# sed -i "s/Ciphers.*/Ciphers WRONG STRING/g" /etc/ssh/sshd_config
[root at rhel6 bash]# grep Ciphers /etc/ssh/sshd_config ; bash sshd_use_approved_ciphers.sh ; grep Ciphers /etc/ssh/sshd_config
Ciphers WRONG STRING
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
---
 .../input/fixes/bash/sshd_use_approved_ciphers.sh  |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh

diff --git a/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
new file mode 100644
index 0000000..a00eb95
--- /dev/null
+++ b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
@@ -0,0 +1,5 @@
+grep -q ^Ciphers /etc/ssh/sshd_config && \
+  sed -i "s/Ciphers.*/Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/g" /etc/ssh/sshd_config
+if ! [ $? -eq 0 ]; then
+    echo "Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc" >> /etc/ssh/sshd_config
+fi
-- 
1.7.1



More information about the scap-security-guide mailing list